CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Showing 1โ1 of 1 advisories (Page 1/1)
2026-11-01
Apache Wicket AjaxNewWindowNotifyingBehavior Cross-Site Scripting (XSS) Vulnerability (CVE-2026-82956)
[Affected Scope] Apache Wicket versions 8.0.0 to 8.19.0, 9.0.0 to 9.24.0, and 10.0.0 to 10.11.0, specifically when AjaxNewWindowNotifyingBehavior is explicitly used
[Impact] Attackers can manipulate the browser's window.name to execute arbitrary malicious JavaScript within the victim's session context, leading to session hijacking and data theft
[Mitigation] Immediately upgrade to patched Apache Wicket versions 8.20.0, 9.25.0, or 10.12.0